I'm currently building a report using Pivot tables. I'm trying to get my data model to look like this:
GroupName AverageAge AverageGrade AverageAgeGreaterThan35
GroupA 30 90 False
GroupB 40 12 True
In this case, the AverageAgeGreaterThan35 column would be an evaluated expression.
I've tried doing this using an evaluated expression but it evaluates for each value, not the average value.
Is there a way to write the evaluated expression to support this?
After reading this answer by gkanapathy (http://answers.splunk.com/answers/34208/eval-mean-something-when-data-is-split-by-another-field.html... ) I came to the solution.
What I did was use eventstats
to add the average first, and then use stats and eval to build up my string. Something like this:
* | eventstats avg(Age) as CalcAvgAvge by GroupName | stats first(eval(if(CalcAvgAvge>35, "True", "False"))) AS AverageAgeGreaterThan35, avg(Age) as AverageAge, avg(Grade) as AverageGrade by GroupName,
After reading this answer by gkanapathy (http://answers.splunk.com/answers/34208/eval-mean-something-when-data-is-split-by-another-field.html... ) I came to the solution.
What I did was use eventstats
to add the average first, and then use stats and eval to build up my string. Something like this:
* | eventstats avg(Age) as CalcAvgAvge by GroupName | stats first(eval(if(CalcAvgAvge>35, "True", "False"))) AS AverageAgeGreaterThan35, avg(Age) as AverageAge, avg(Grade) as AverageGrade by GroupName,